Cursor 为操控其桌面 AI 代理构建了一个隐藏的终端命令

Finding

Cursor 3.16.17 contains a working, gated Desktop Bridge that lets the bundled cursor CLI enumerate agent threads open in Cursor Desktop and submit follow-up instructions to them.

How we verified

Methods: reverse engineering, testing.

Cursor’s packaged application contains the cursor desktop CLI parser and help text, an authenticated local Desktop Bridge service, a gated Beta settings card, and desktop handlers for listing and messaging agent threads. In a reporter-owned test, cursor desktop ls --json returned the prepared thread’s ID, title, completed status, local source and window ID. cursor desktop send reported that the follow-up was submitted. Cursor Desktop displayed the terminal-sent instruction and returned the exact requested response: DESKTOP-BRIDGE-LIVE-OK. Cursor’s CLI guide and CLI changelog contained no reference to cursor desktop or Desktop Bridge when reviewed on August 18, 2026.

RuntimeWire extracted and examined the packaged JavaScript from Cursor’s stable Windows x64 build, version 3.16.17. We confirmed the build version, commit and date from package.json and product.json, then traced the desktop_bridge feature gate, disabled-by-default user setting, local bridge startup, discovery mechanism, bearer authentication, CLI commands and desktop message handlers.

We activated the feature through Cursor’s built-in test-feature mechanism, enabled “Allow CLI to access desktop agents” in the exposed Beta card and restarted Cursor with real agent HTTP enabled. We created a disposable thread on a reporter-controlled account, enumerated it through cursor desktop ls --json and sent a deterministic no-operation instruction through cursor desktop send. The agent returned the exact requested token inside the original desktop conversation. We preserved screenshots and calculated SHA-256 hashes for the source archive, relevant application files and successful test image. No third-party account, conversation or data was accessed.

Tested versions:

• Cursor 3.16.17
• Windows x64 stable
• commit 6b2afae0257df2bb5e1835f15165dc2f0de056b0
• built 2026-08-14T01:41:12.803Z

Reproduction

RuntimeWire independently reproduced the core finding.

Requirements: Cursor 3.16.17 for Windows x64 and a reporter-controlled Cursor account.

Quit every running Cursor process. Launch Cursor with its built-in smoke-test driver, real agent HTTP and the desktop_bridge feature override:

$CursorExe = "$env\Programs\cursor\Cursor.exe" $DesktopBridgeFlag = "eyJkZXNrdG9wX2JyaWRnZSI6dHJ1ZX0="

Start-Process -FilePath $CursorExe -ArgumentList @( "--glass" "--enable-smoke-test-driver" "--smoke-test-use-real-agent-http" "--test-feature-flags=$DesktopBridgeFlag" )

Open Cursor Settings → Beta. Enable “Allow CLI to access desktop agents.” Quit Cursor completely and relaunch it with the same arguments. Create a disposable agent thread titled “Bridge thread readiness.” Ask it to reply with BRIDGE-THREAD-READY without editing files or running commands. In PowerShell, locate the thread:

$CursorCmd = "$env\Programs\cursor\resources\app\bin\cursor.cmd" $Threads = (& $CursorCmd desktop ls --json) | ConvertFrom-Json $Target = $Threads | Where-Object { $_.title -eq "Bridge thread readiness" } | Select-Object -First 1

Confirm that $Target contains an ID, title, status, source and window ID. Submit the follow-up:

& $CursorCmd desktop send $Target.id "Reply with exactly DESKTOP-BRIDGE-LIVE-OK. Do not edit files or run commands."

Confirm that PowerShell reports the message as submitted and that DESKTOP-BRIDGE-LIVE-OK appears inside the original Cursor Desktop conversation.

File hashes

• sha256 resources/app/out/cli.js
• sha256:4ca5f52518ec5fea1a0c4732c6216dc45182b59a1fe2146d3f9ad6062a3490cd resources/app/out/main.js
• sha256:50ec9d3e80b9f797378eb1a6896ecdadc3a0e3daabe9fec440a1f4e2d6c1878d resources/app/out/vs/workbench/workbench.glass.main.js
• sha256:2100a37e6ddd23fd3f0adf982dcd6779a525c25f0d6acb9fa0683a44cb947592 resources/app/out/vs/workbench/workbench.desktop.main.js
• sha256:9dabecdb4d25cdf8a7b29800fa186bd227b25483789cd7536bbe68b2c5cd92f2 successful-desktop-bridge-test.png

Company response

RuntimeWire requested comment; the company had not responded by publication time.